REDHAT-BUG-632239: XSS
First published: Thu Sep 09 2010(Updated: )
As of the 1.2 release, the core Django framework includes a system, enabled by default, for detecting and preventing cross-site request forgery (CSRF) attacks against Django-powered applications. Previous Django releases provided a different, optionally-enabled system for the same purpose. The Django 1.2 CSRF protection system involves the generation of a random token, inserted as a hidden field in outgoing forms. The same value is also set in a cookie, and the cookie value and form value are compared on submission. The provided template tag for inserting the CSRF token into forms -- {% csrf_token %} -- explicitly trusts the cookie value, and displays it as-is. Thus, an attacker who is able to tamper with the value of the CSRF cookie can cause arbitrary content to be inserted, unescaped, into the outgoing HTML of the form, enabling cross-site scripting (XSS) attacks. This issue was first reported via a public ticket in Django's Trac instance; while being triaged it was then independently reported, with broader description, by Jeff Balogh of Mozilla. <a href="http://www.djangoproject.com/weblog/2010/sep/08/security-release/">http://www.djangoproject.com/weblog/2010/sep/08/security-release/</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Django | >1.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of REDHAT-BUG-632239?
The severity of REDHAT-BUG-632239 is considered high due to the potential for cross-site request forgery (CSRF) attacks against vulnerable Django applications.
How do I fix REDHAT-BUG-632239?
To fix REDHAT-BUG-632239, upgrade to the most recent version of Django that includes enhanced CSRF protection features.
What versions of Django are affected by REDHAT-BUG-632239?
REDHAT-BUG-632239 affects all versions of Django prior to 1.2.
What is cross-site request forgery (CSRF) in the context of REDHAT-BUG-632239?
Cross-site request forgery (CSRF) is a type of attack that tricks the user into executing unwanted actions on a different site where they are authenticated.
Is CSRF protection enabled by default in Django version 1.2 and later?
Yes, CSRF protection is enabled by default in Django version 1.2 and later, addressing the vulnerability described in REDHAT-BUG-632239.
- agent/weakness
- agent/last-modified-date
- agent/first-publish-date
- agent/type
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2010-3082
- agent/references
- agent/severity
- agent/description
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/django
- canonical/django